How do I open a secure WSS websocket in KDB?

I'm trying to figure out how to connect to a data feed.

The data feed is at

wss: ":wss://stream.data.alpaca.markets/v2/iex"
.z.ws:{0N!x;}
r:(`$wss)""

I have set up TLS in KDB and can access https endpoints just fine. This says OS reports: No route to host.

The documentation refers to using stunnel, but doesn't clarify whether that's for securing KDB as a server (which is what stunnel looks like it's mainly for), or decrypting a feed as a client.

https://code.kx.com/q/kb/websockets/#simple-websocket-client-example

What am I doing wrong?

Solution

Stunnel can be used to encrypt or decrypt any TCP SSL connection, including websockets.

To get KDB to connect to a secure websocket, you need to use stunnel in client mode.

This is the config that worked for me. You can then open the decrypted websocket on your localhost at ws://localhost:80

foreground = yes
debug = 7
[alpaca websocket]
accept = 80
client = yes

connect = stream.data.alpaca.markets:443
CApath = /etc/ssl/certs/
checkHost = stream.data.alpaca.markets 
OCSPaia = no 
verifyChain=yes